@zaly/agent 0.0.3

package/dist/registry-CFmR5G3J.mjs

@@ -0,0 +1,564 @@
+import { a as __toESM, n as parseBash, r as __commonJSMin, t as TOOLS } from "./tools-DW1dbcCz.mjs";
+import { normPath, prettyPath } from "@zaly/shared";
+import { createRegistry } from "@zaly/shared/registry";
+import { dirname, isAbsolute, relative } from "pathe";
+//#region src/permissions/handlers/bash.ts
+/**
+* Handler for `Rule<"bash">` — evaluates a bash command line against
+* pattern rules, then delegates each segment's inferred and explicit
+* file paths to the file handler via `ctx.validate("read"|"write", …)`.
+*
+* Composition keeps file-rule logic in one place: the bash handler
+* doesn't know about workspaces, sensitive files, or path-pattern
+* matching — it just asks the registered handler for those scopes.
+*
+* Sources of file paths per segment:
+*   - `seg.reads` / `seg.writes` — explicit `<` / `>` / `>>` redirects
+*     extracted by the parser.
+*   - `TOOLS[cmd].reads/writes(args)` — inferred from built-in tool
+*     specs (e.g. `cat foo.txt` reads `foo.txt`, `tee out` writes `out`).
+*
+* Suggestions and reasons from inner `validate` calls bubble up so the
+* prompt UI can offer "allow `Bash(cat:*)`" alongside "add ~/Documents
+* as workspace" in a single ask.
+*/
+const bashHandler = { validate(input, ctx) {
+	const parsed = parseBash(input);
+	if (!parsed.ok) return {
+		ask: `Allow this bash command? (${parsed.reason})`,
+		reason: parsed.reason,
+		verdict: "ask"
+	};
+	let verdict = "allow";
+	let reason;
+	const suggestions = [];
+	for (const seg of parsed.segments) {
+		const cmdVerdict = resolveRules(ctx.rules, seg) ?? "ask";
+		if (seg.hasCommandSubst && cmdVerdict !== "allow") return {
+			ask: `Allow command substitution in \`${seg.cmd}\`?`,
+			reason: "command substitution not allowed",
+			verdict: "ask"
+		};
+		const spec = TOOLS[seg.cmd];
+		if (spec?.unsafe?.(seg.args) && cmdVerdict !== "allow") return {
+			ask: `Allow invocation of \`${seg.cmd}\`? (unsafe)`,
+			reason: `${seg.cmd}: invocation mode not safely modelled`,
+			verdict: "ask"
+		};
+		let segVerdict = cmdVerdict;
+		let segReason = cmdVerdict === "allow" ? void 0 : `segment "${seg.cmd}" → ${cmdVerdict}`;
+		if (cmdVerdict === "ask") suggestions.push({
+			kind: "rule",
+			pattern: seg.args.length > 0 ? `${seg.cmd}:*` : seg.cmd,
+			scope: "bash"
+		});
+		const reads = [...spec?.reads?.(seg.args) ?? [], ...seg.reads];
+		const writes = [...spec?.writes?.(seg.args) ?? [], ...seg.writes.map((w) => w.path)];
+		for (const path of reads) {
+			if (seg.dyn?.has(path)) {
+				segVerdict = combine(segVerdict, "ask");
+				segReason ??= `${seg.cmd}: read ${path}: dynamic path`;
+				suggestions.push({
+					kind: "rule",
+					pattern: `${seg.cmd}:*`,
+					scope: "bash"
+				});
+				continue;
+			}
+			const r = ctx.validate("read", path);
+			segVerdict = combine(segVerdict, r.verdict);
+			if (r.verdict !== "allow") {
+				segReason ??= `${seg.cmd}: read ${path}: ${r.reason}`;
+				if (r.suggestions) suggestions.push(...r.suggestions);
+			}
+			if (segVerdict === "deny") break;
+		}
+		if (segVerdict !== "deny") for (const path of writes) {
+			if (seg.dyn?.has(path)) {
+				segVerdict = combine(segVerdict, "ask");
+				segReason ??= `${seg.cmd}: write ${path}: dynamic path`;
+				suggestions.push({
+					kind: "rule",
+					pattern: `${seg.cmd}:*`,
+					scope: "bash"
+				});
+				continue;
+			}
+			const w = ctx.validate("write", path);
+			segVerdict = combine(segVerdict, w.verdict);
+			if (w.verdict !== "allow") {
+				segReason ??= `${seg.cmd}: write ${path}: ${w.reason}`;
+				if (w.suggestions) suggestions.push(...w.suggestions);
+			}
+			if (segVerdict === "deny") break;
+		}
+		verdict = combine(verdict, segVerdict);
+		if (verdict !== "allow" && reason === void 0) reason = segReason;
+		if (verdict === "deny") break;
+	}
+	return verdict === "allow" ? { verdict: "allow" } : {
+		ask: `Allow this bash command?`,
+		reason: reason ?? "no rule matched",
+		suggestions: suggestions.length > 0 ? suggestions : void 0,
+		verdict
+	};
+} };
+/** Combine two verdicts: deny dominates, ask beats allow. */
+function combine(a, b) {
+	if (a === "deny" || b === "deny") return "deny";
+	if (a === "ask" || b === "ask") return "ask";
+	return "allow";
+}
+const patternCache = /* @__PURE__ */ new Map();
+function parsePattern(pattern) {
+	const cached = patternCache.get(pattern);
+	if (cached) return cached;
+	let body = pattern.trim();
+	let trailingWildcard = false;
+	if (body.endsWith(":*")) {
+		trailingWildcard = true;
+		body = body.slice(0, -2);
+	}
+	const tokens = body.split(/\s+/).filter((s) => s.length > 0);
+	const result = {
+		cmd: tokens[0] ?? "",
+		parts: tokens.slice(1),
+		trailingWildcard
+	};
+	patternCache.set(pattern, result);
+	return result;
+}
+function matchPart(part, value) {
+	if (part.endsWith("*")) return value.startsWith(part.slice(0, -1));
+	return part === value;
+}
+/** Test whether a parsed segment matches a rule pattern. */
+function matchRule(rule, seg) {
+	const p = parsePattern(rule.pattern);
+	if (p.cmd === "*" && p.parts.length === 0) return true;
+	if (p.cmd !== seg.cmd) return false;
+	if (seg.args.length < p.parts.length) return false;
+	for (let i = 0; i < p.parts.length; i++) if (!matchPart(p.parts[i], seg.args[i])) return false;
+	if (p.trailingWildcard) return true;
+	return seg.args.length === p.parts.length;
+}
+/** First-match-wins resolution. Returns `undefined` if no rule matches. */
+function resolveRules(rules, seg) {
+	for (const r of rules) if (matchRule(r, seg)) return r.policy;
+}
+//#endregion
+//#region src/permissions/handlers/files.ts
+var import_ignore = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	function makeArray(subject) {
+		return Array.isArray(subject) ? subject : [subject];
+	}
+	const UNDEFINED = void 0;
+	const EMPTY = "";
+	const SPACE = " ";
+	const ESCAPE = "\\";
+	const REGEX_TEST_BLANK_LINE = /^\s+$/;
+	const REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/;
+	const REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/;
+	const REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/;
+	const REGEX_SPLITALL_CRLF = /\r?\n/g;
+	const REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
+	const REGEX_TEST_TRAILING_SLASH = /\/$/;
+	const SLASH = "/";
+	let TMP_KEY_IGNORE = "node-ignore";
+	/* istanbul ignore else */
+	if (typeof Symbol !== "undefined") TMP_KEY_IGNORE = Symbol.for("node-ignore");
+	const KEY_IGNORE = TMP_KEY_IGNORE;
+	const define = (object, key, value) => {
+		Object.defineProperty(object, key, { value });
+		return value;
+	};
+	const REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g;
+	const RETURN_FALSE = () => false;
+	const sanitizeRange = (range) => range.replace(REGEX_REGEXP_RANGE, (match, from, to) => from.charCodeAt(0) <= to.charCodeAt(0) ? match : EMPTY);
+	const cleanRangeBackSlash = (slashes) => {
+		const { length } = slashes;
+		return slashes.slice(0, length - length % 2);
+	};
+	const REPLACERS = [
+		[/^\uFEFF/, () => EMPTY],
+		[/((?:\\\\)*?)(\\?\s+)$/, (_, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY)],
+		[/(\\+?)\s/g, (_, m1) => {
+			const { length } = m1;
+			return m1.slice(0, length - length % 2) + SPACE;
+		}],
+		[/[\\$.|*+(){^]/g, (match) => `\\${match}`],
+		[/(?!\\)\?/g, () => "[^/]"],
+		[/^\//, () => "^"],
+		[/\//g, () => "\\/"],
+		[/^\^*\\\*\\\*\\\//, () => "^(?:.*\\/)?"],
+		[/^(?=[^^])/, function startingReplacer() {
+			return !/\/(?!$)/.test(this) ? "(?:^|\\/)" : "^";
+		}],
+		[/\\\/\\\*\\\*(?=\\\/|$)/g, (_, index, str) => index + 6 < str.length ? "(?:\\/[^\\/]+)*" : "\\/.+"],
+		[/(^|[^\\]+)(\\\*)+(?=.+)/g, (_, p1, p2) => {
+			return p1 + p2.replace(/\\\*/g, "[^\\/]*");
+		}],
+		[/\\\\\\(?=[$.|*+(){^])/g, () => ESCAPE],
+		[/\\\\/g, () => ESCAPE],
+		[/(\\)?\[([^\]/]*?)(\\*)($|\])/g, (match, leadEscape, range, endEscape, close) => leadEscape === ESCAPE ? `\\[${range}${cleanRangeBackSlash(endEscape)}${close}` : close === "]" ? endEscape.length % 2 === 0 ? `[${sanitizeRange(range)}${endEscape}]` : "[]" : "[]"],
+		[/(?:[^*])$/, (match) => /\/$/.test(match) ? `${match}$` : `${match}(?=$|\\/$)`]
+	];
+	const REGEX_REPLACE_TRAILING_WILDCARD = /(^|\\\/)?\\\*$/;
+	const MODE_IGNORE = "regex";
+	const MODE_CHECK_IGNORE = "checkRegex";
+	const TRAILING_WILD_CARD_REPLACERS = {
+		[MODE_IGNORE](_, p1) {
+			return `${p1 ? `${p1}[^/]+` : "[^/]*"}(?=$|\\/$)`;
+		},
+		[MODE_CHECK_IGNORE](_, p1) {
+			return `${p1 ? `${p1}[^/]*` : "[^/]*"}(?=$|\\/$)`;
+		}
+	};
+	const makeRegexPrefix = (pattern) => REPLACERS.reduce((prev, [matcher, replacer]) => prev.replace(matcher, replacer.bind(pattern)), pattern);
+	const isString = (subject) => typeof subject === "string";
+	const checkPattern = (pattern) => pattern && isString(pattern) && !REGEX_TEST_BLANK_LINE.test(pattern) && !REGEX_INVALID_TRAILING_BACKSLASH.test(pattern) && pattern.indexOf("#") !== 0;
+	const splitPattern = (pattern) => pattern.split(REGEX_SPLITALL_CRLF).filter(Boolean);
+	var IgnoreRule = class {
+		constructor(pattern, mark, body, ignoreCase, negative, prefix) {
+			this.pattern = pattern;
+			this.mark = mark;
+			this.negative = negative;
+			define(this, "body", body);
+			define(this, "ignoreCase", ignoreCase);
+			define(this, "regexPrefix", prefix);
+		}
+		get regex() {
+			const key = "_regex";
+			if (this[key]) return this[key];
+			return this._make(MODE_IGNORE, key);
+		}
+		get checkRegex() {
+			const key = "_checkRegex";
+			if (this[key]) return this[key];
+			return this._make(MODE_CHECK_IGNORE, key);
+		}
+		_make(mode, key) {
+			const str = this.regexPrefix.replace(REGEX_REPLACE_TRAILING_WILDCARD, TRAILING_WILD_CARD_REPLACERS[mode]);
+			const regex = this.ignoreCase ? new RegExp(str, "i") : new RegExp(str);
+			return define(this, key, regex);
+		}
+	};
+	const createRule = ({ pattern, mark }, ignoreCase) => {
+		let negative = false;
+		let body = pattern;
+		if (body.indexOf("!") === 0) {
+			negative = true;
+			body = body.substr(1);
+		}
+		body = body.replace(REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION, "!").replace(REGEX_REPLACE_LEADING_EXCAPED_HASH, "#");
+		const regexPrefix = makeRegexPrefix(body);
+		return new IgnoreRule(pattern, mark, body, ignoreCase, negative, regexPrefix);
+	};
+	var RuleManager = class {
+		constructor(ignoreCase) {
+			this._ignoreCase = ignoreCase;
+			this._rules = [];
+		}
+		_add(pattern) {
+			if (pattern && pattern[KEY_IGNORE]) {
+				this._rules = this._rules.concat(pattern._rules._rules);
+				this._added = true;
+				return;
+			}
+			if (isString(pattern)) pattern = { pattern };
+			if (checkPattern(pattern.pattern)) {
+				const rule = createRule(pattern, this._ignoreCase);
+				this._added = true;
+				this._rules.push(rule);
+			}
+		}
+		add(pattern) {
+			this._added = false;
+			makeArray(isString(pattern) ? splitPattern(pattern) : pattern).forEach(this._add, this);
+			return this._added;
+		}
+		test(path, checkUnignored, mode) {
+			let ignored = false;
+			let unignored = false;
+			let matchedRule;
+			this._rules.forEach((rule) => {
+				const { negative } = rule;
+				if (unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored) return;
+				if (!rule[mode].test(path)) return;
+				ignored = !negative;
+				unignored = negative;
+				matchedRule = negative ? UNDEFINED : rule;
+			});
+			const ret = {
+				ignored,
+				unignored
+			};
+			if (matchedRule) ret.rule = matchedRule;
+			return ret;
+		}
+	};
+	const throwError = (message, Ctor) => {
+		throw new Ctor(message);
+	};
+	const checkPath = (path, originalPath, doThrow) => {
+		if (!isString(path)) return doThrow(`path must be a string, but got \`${originalPath}\``, TypeError);
+		if (!path) return doThrow(`path must not be empty`, TypeError);
+		if (checkPath.isNotRelative(path)) return doThrow(`path should be a \`path.relative()\`d string, but got "${originalPath}"`, RangeError);
+		return true;
+	};
+	const isNotRelative = (path) => REGEX_TEST_INVALID_PATH.test(path);
+	checkPath.isNotRelative = isNotRelative;
+	/* istanbul ignore next */
+	checkPath.convert = (p) => p;
+	var Ignore = class {
+		constructor({ ignorecase = true, ignoreCase = ignorecase, allowRelativePaths = false } = {}) {
+			define(this, KEY_IGNORE, true);
+			this._rules = new RuleManager(ignoreCase);
+			this._strictPathCheck = !allowRelativePaths;
+			this._initCache();
+		}
+		_initCache() {
+			this._ignoreCache = Object.create(null);
+			this._testCache = Object.create(null);
+		}
+		add(pattern) {
+			if (this._rules.add(pattern)) this._initCache();
+			return this;
+		}
+		addPattern(pattern) {
+			return this.add(pattern);
+		}
+		_test(originalPath, cache, checkUnignored, slices) {
+			const path = originalPath && checkPath.convert(originalPath);
+			checkPath(path, originalPath, this._strictPathCheck ? throwError : RETURN_FALSE);
+			return this._t(path, cache, checkUnignored, slices);
+		}
+		checkIgnore(path) {
+			if (!REGEX_TEST_TRAILING_SLASH.test(path)) return this.test(path);
+			const slices = path.split(SLASH).filter(Boolean);
+			slices.pop();
+			if (slices.length) {
+				const parent = this._t(slices.join(SLASH) + SLASH, this._testCache, true, slices);
+				if (parent.ignored) return parent;
+			}
+			return this._rules.test(path, false, MODE_CHECK_IGNORE);
+		}
+		_t(path, cache, checkUnignored, slices) {
+			if (path in cache) return cache[path];
+			if (!slices) slices = path.split(SLASH).filter(Boolean);
+			slices.pop();
+			if (!slices.length) return cache[path] = this._rules.test(path, checkUnignored, MODE_IGNORE);
+			const parent = this._t(slices.join(SLASH) + SLASH, cache, checkUnignored, slices);
+			return cache[path] = parent.ignored ? parent : this._rules.test(path, checkUnignored, MODE_IGNORE);
+		}
+		ignores(path) {
+			return this._test(path, this._ignoreCache, false).ignored;
+		}
+		createFilter() {
+			return (path) => !this.ignores(path);
+		}
+		filter(paths) {
+			return makeArray(paths).filter(this.createFilter());
+		}
+		test(path) {
+			return this._test(path, this._testCache, true);
+		}
+	};
+	const factory = (options) => new Ignore(options);
+	const isPathValid = (path) => checkPath(path && checkPath.convert(path), path, RETURN_FALSE);
+	/* istanbul ignore next */
+	const setupWindows = () => {
+		const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
+		checkPath.convert = makePosix;
+		const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
+		checkPath.isNotRelative = (path) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path) || isNotRelative(path);
+	};
+	/* istanbul ignore next */
+	if (typeof process !== "undefined" && process.platform === "win32") setupWindows();
+	module.exports = factory;
+	factory.default = factory;
+	module.exports.isPathValid = isPathValid;
+	define(module.exports, Symbol.for("setupWindows"), setupWindows);
+})))(), 1);
+/**
+* Handler for `Rule<"read" | "write">` — one impl serves both scopes
+* because they share the same matcher and the same workspace state.
+*
+* Algorithm:
+*   1. Normalize candidate to an absolute path.
+*   2. Sensitive-file check (env, ssh keys, credentials) → deny.
+*   3. Find the longest-prefix workspace containing the path. None →
+*      ask, with a `kind: "workspace"` suggestion for the containing
+*      directory.
+*   4. Inside a workspace: resolve the first matching rule against the
+*      workspace-relative path. Earlier rules win.
+*   5. Default when no rule matches but the path is inside a workspace:
+*      `allow` for reads (workspace = trust signal), `ask` for writes
+*      (mutating ops escalate by default; users add `Write(...)` rules
+*      to whitelist).
+*
+* Pattern grammar (per Claude-Code conventions):
+*   //abs/path          absolute filesystem path
+*   ~/path              path under home directory
+*   /path or path       workspace-relative (passed through to gitignore)
+*/
+const fileHandler = { validate(input, ctx) {
+	const abs = normPath(ctx.cwd, input);
+	if (isSensitiveFile(abs)) return {
+		reason: `${abs}: sensitive file`,
+		verdict: "deny"
+	};
+	const ws = longestWorkspace(abs, ctx.workspaces);
+	const inWorkspace = ws !== void 0;
+	if (inWorkspace && abs === ws) return { verdict: "allow" };
+	const base = ws ?? "/";
+	const rel = relative(base, abs);
+	const verb = ctx.scope === "read" ? "reading" : "writing";
+	const rule = resolveRule$1(base, rel, ctx.rules);
+	if (rule?.policy === "deny") return {
+		reason: `${abs}: denied by rule`,
+		verdict: "deny"
+	};
+	if (rule?.policy === "ask") return {
+		ask: `Allow ${verb} ${prettyPath(abs)}?`,
+		reason: `${abs}: rule requires confirmation`,
+		suggestions: [{
+			kind: "rule",
+			pattern: `/${rel}`,
+			scope: ctx.scope
+		}],
+		verdict: "ask"
+	};
+	if (rule?.policy === "allow") return { verdict: "allow" };
+	if (!inWorkspace) {
+		const parent = dirname(abs);
+		return {
+			ask: `Allow ${verb} ${prettyPath(abs)}? (not in any workspace)`,
+			reason: `${abs}: outside any workspace`,
+			suggestions: [{
+				description: `add ${parent} as workspace`,
+				kind: "workspace",
+				path: parent
+			}],
+			verdict: "ask"
+		};
+	}
+	if (ctx.scope === "read") return { verdict: "allow" };
+	return {
+		ask: `Allow ${verb} ${prettyPath(abs)}?`,
+		reason: `${abs}: write requires confirmation`,
+		suggestions: [{
+			kind: "rule",
+			pattern: `/${rel}`,
+			scope: "write"
+		}],
+		verdict: "ask"
+	};
+} };
+/** True if `path` looks like a credentials/keys file we shouldn't
+*  expose to the model by default. Conservative — false positives are
+*  fine here, and users can override via `allow` rules. */
+function isSensitiveFile(path) {
+	return SENSITIVE_PATTERNS.some((re) => re.test(path));
+}
+/** Common locations for credentials, keys, and other sensitive data.
+*  Matched against the path string directly — covers both absolute and
+*  relative inputs. Add to this list as new gotchas surface. */
+const SENSITIVE_PATTERNS = [
+	/(?:^|\/)\.env(?:\.|$)/,
+	/(?:^|\/)\.git\/(?!hooks\/)/,
+	/(?:^|\/)\.ssh\//,
+	/(?:^|\/)\.aws\/credentials/,
+	/(?:^|\/)\.netrc$/,
+	/(?:^|\/)id_(?:rsa|dsa|ed25519|ecdsa)(?:\.pub)?$/,
+	/(?:^|\/)\.npmrc$/,
+	/(?:^|\/)\.pypirc$/,
+	/(?:^|\/)secrets?\//,
+	/(?:^|\/)credentials?(?:\.|\/)/
+];
+/** Longest-prefix match against the workspace list — returns the
+*  containing workspace's absolute path, or undefined if none contain
+*  the candidate. Workspaces arrive pre-normalized from the manager. */
+function longestWorkspace(abs, workspaces) {
+	let best;
+	for (const root of workspaces) if (abs === root || abs.startsWith(root.endsWith("/") ? root : `${root}/`)) {
+		if (best === void 0 || root.length > best.length) best = root;
+	}
+	return best;
+}
+/** Resolve the first matching rule.
+*  Patterns get normalized (`//abs`, `~/`, `/rel`, `rel`) into
+*  workspace-rooted gitignore syntax; patterns that resolve outside the
+*  candidate's workspace are dropped (they don't apply here). */
+function resolveRule$1(workspace, rel, rules) {
+	if (rel === "") return void 0;
+	for (const rule of rules) {
+		const norm = normalizePattern(rule.pattern, workspace);
+		if (norm === void 0) continue;
+		try {
+			if ((0, import_ignore.default)().add(norm).ignores(rel)) return rule;
+		} catch {}
+	}
+}
+function normalizePattern(pattern, workspace) {
+	if (pattern.startsWith("//")) return relativizeToWorkspace(pattern.slice(1), workspace);
+	if (pattern.startsWith("~/")) return relativizeToWorkspace(normPath(pattern), workspace);
+	return pattern;
+}
+function relativizeToWorkspace(absPattern, workspace) {
+	const rel = relative(workspace, absPattern);
+	if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) return void 0;
+	return `/${rel}`;
+}
+//#endregion
+//#region src/permissions/handlers/tool.ts
+/**
+* Generic tool-scope handler.
+*
+* Used by `Tasks` to gate every tool dispatch on the tool name, and
+* available to tools themselves for richer checks (e.g. fetch passing
+* `fetch:example.com` so users can ask-for-domain).
+*
+* Pattern grammar is gitignore-style — reuses the `ignore` package so
+* the syntax matches `read` / `write` patterns. Common shapes:
+*
+*   "tool"             → bare scope; matches every input  (default-allow)
+*   "tool(bash)"       → exact match for `"bash"`
+*   "tool(fetch:*)"    → glob match `"fetch:..."`
+*   "tool(task_*)"     → glob match `"task_..."`
+*
+* Resolution is first-match-wins. Default verdict when no rule matches is
+* `allow` — an unconfigured `tool` scope should not surprise users by
+* gating ordinary tool calls.
+*/
+const toolHandler = { validate(input, ctx) {
+	const rule = resolveRule(input, ctx.rules);
+	if (rule?.policy === "deny") return {
+		reason: `tool ${input}: denied by rule`,
+		verdict: "deny"
+	};
+	if (rule?.policy === "ask") return {
+		ask: `Allow tool ${input}?`,
+		reason: `tool ${input}: rule requires confirmation`,
+		suggestions: [{
+			kind: "rule",
+			pattern: input,
+			scope: "tool"
+		}],
+		verdict: "ask"
+	};
+	return { verdict: "allow" };
+} };
+function resolveRule(input, rules) {
+	for (const rule of rules) if ((0, import_ignore.default)().add(rule.pattern).ignores(input)) return rule;
+}
+const handlerRegistry = createRegistry("scope").from({
+	bash: () => bashHandler,
+	read: () => fileHandler,
+	tool: () => toolHandler,
+	write: () => fileHandler
+});
+//#endregion
+export { handlerRegistry as t };
+
+//# sourceMappingURL=registry-CFmR5G3J.mjs.map